netool.io Pro2: what a pocket network tester tells you about a port

You’re standing at an unlabelled wall jack or patch-panel port, and you want to know where it goes. Which switch is it on, which port, which VLAN, does it get an address, and does it reach the internet? The traditional answer is a laptop with a USB Ethernet adapter, Wireshark and patience. A pocket tester answers the same first questions from a phone in a few seconds.

I carry one of these, a netool.io Pro2, which I bought myself and use regularly as a network admin. This post covers what it reports, what the Pro2 adds over the cheaper Lite, what it can’t tell you, and how I use mine. Product facts come from the vendor’s own pages, linked at the end.

Disclosure: this post isn’t sponsored. There’s no referral or affiliate link, and I have no financial incentive of any kind. It’s a tool I paid for and find value in.

What it is

The Pro2 (model NE1D) is a small box, about 108 × 44 × 19 mm and 86 g, with an Ethernet port, a USB-C charging port and a USB-C data port. It has no screen. You drive it from the netool.io app on iOS, iPadOS or Android, which connects to the tester over Bluetooth LE or 2.4 GHz Wi-Fi. Some features, such as exporting automation rules and credentials, only work in Wi-Fi mode.

At the time of writing, the vendor lists the Pro2 at $299 with a patch cable, AC adapter and USB-C cable in the box. The Lite is $219. The vendor doesn’t list a subscription for the core features.

What it tells you at a port

Plug it into the port, open the app, and it collects the following.

Question	How it finds out
Which switch and port is this?	Listens for discovery-protocol advertisements: LLDP, CDP (including CDPv2), EDP, FDP and SONMP. The switch’s advertisement usually carries its name, the port ID, the port’s VLAN and a management address.
Which VLANs are tagged on this port?	Watches for live 802.1Q-tagged frames and lists the VLAN IDs it sees.
Does it get an address?	Runs DHCP (IPv4 and IPv6) and shows the address, server, lease time and options.
Does 802.1X work here?	Tries port authentication and reports whether it succeeded, and which address scope or VLAN it landed on.
Does it reach anything?	Ping, HTTP/HTTPS to a URL you choose, traceroute, and public-IP detection.
What else is on this segment?	Spanning tree and LACP are recognised from captured frames. The Pro2 also does ARP and TCP port scanning (below).

You can save a result against a “tag” for later, share it, or sync it to the vendor’s netool.cloud, which was still marked beta when this was written.

What the Pro2 adds over the Lite

Both models do everything in the table above. The Pro2 adds the following:

• ARP and TCP port scanning of the connected subnet. The vendor says there’s no limit on subnet size.
• Packet capture to a USB stick in the data port, with filtering and conversion to text. Bring your own stick.
• Rconsole, an RS232 serial console through an optional cable ($19 at the time of writing). It needs Pro2 firmware build 191 or later and app 2.0.30 or later.
• Switch automation over SSH. The tester logs in to the switch and sets an untagged port’s VLAN or a trunk’s tagged VLANs, or runs your own “IF/THEN” command rules. The vendor lists Cisco IOS, Dell PowerConnect, Ubiquiti EdgeOS, Netgear ProSafe, HP/Aruba and MikroTik RouterOS, with Juniper and Brocade/Ruckus in development. The IF/THEN rules work with any device you can reach over SSH.

The vendor also describes the Pro2 as faster, with more RAM and storage than the Lite, but gives no figures.

How I use mine

I mostly reach for it to get the first answers about a port before I touch anything else:

• LLDP discovery. This is the feature that saves me the most time. I plug into a run and get the switch name and port straight away, so I rarely have to tone out a cable to find where it lands.
• Quick information gathering. Alongside the switch and port, I get the VLAN and the rest of the port’s details without walking back to a closet or logging in to anything.
• VLAN enumeration. Seeing which tagged VLANs are live on a port tells me straight away whether it’s an access port, a trunk, or not what the label says.
• DHCP testing. I check whether the port gets a lease, from which server, and with which options. That settles most “the device won’t get an address” questions in one step.
• DNS and WAN checks. The public-IP, HTTP and traceroute tests show whether a port actually gets out to the internet, and a test to a URL by name also tells me name resolution works.

I also have the Rconsole cable, so the same pocket tool gives me a serial console when a device has no network access at all.

What it can’t tell you

• Only what the network shares. Discovery results depend on the switch advertising LLDP or CDP on that port. Many networks turn discovery off on user-facing ports, and if they have, you won’t get a switch name or port. The tagged-VLAN list only includes VLANs that send traffic while you’re plugged in.
• No cabling or power tests. The product pages don’t list PoE measurement, cable or wire-map testing, or throughput testing. You need a cable tester or a PoE meter for those.
• Connection mode matters. Bluetooth is simpler. Some features need the tester’s Wi-Fi, and the tester only uses 2.4 GHz.
• Battery figures disagree. The product page says “over 9 hours” and the datasheet says 12. Plan around the lower figure.

Security considerations

A tester like this is a network device that you plug into other people’s networks, so a few things deserve thought.

• Authorization. Scanning and packet capture are fine on networks you own or are authorized to test, and a problem anywhere else. A port scan on a monitored network can also set off intrusion detection.
• Credentials on the device. Switch automation means storing SSH credentials on the tester and in the app. Use a dedicated, least-privilege account for it, not a personal admin login, so you can revoke it if the tester is lost. Credential export needs Wi-Fi mode, so treat the exported file like a password file.
• Captures hold real traffic. A packet capture on a USB stick can contain hostnames, addresses and sometimes credentials. Encrypt the stick or wipe it after use.
• Cloud sync is optional. Syncing results to netool.cloud sends what the tester found off the network. Decide whether discovery data from a given network should leave it, and turn on the two-factor authentication the vendor offers if you use it.
• Discovery protocols cut both ways. Everything this tool learns from an LLDP or CDP advertisement, anyone else plugged into that port learns too. If the result surprises you, that’s worth bringing up with whoever runs the network.

Who it suits

It’s for anyone who regularly has to work out what an unknown port is: installers, field technicians and network admins who trace drops. The Lite covers port identification on its own. The Pro2 is worth the difference if you want packet capture, scanning, a serial console in the same pocket, or switch changes you can make while standing at the port. It doesn’t replace a cable certifier or a laptop running Wireshark for deep troubleshooting. It answers the first five questions faster.

References

Vendor pages

• netool.io Pro2 product page: features, Pro2 vs Lite comparison, kit contents and pricing.
• netool.io home page: both models and the Lite price.
• Pro2 datasheet (PDF): dimensions, battery, radios, ports, discovery protocols and certifications.

Standards

• IEEE 802.1AB (LLDP), the vendor-neutral discovery protocol most switches support.
• IEEE 802.1Q (VLAN tagging) and IEEE 802.1X (port-based network access control).